Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
13 distinct techniques documented for this family, organized by ATT&CK tactic.
MITRE ATT&CK® Techniques ... Execution ... T1047 ... Windows Management Instrumentation
MITRE ATT&CK® Techniques ... Persistence ... T1053 ... Scheduled Task/Job
After encrypting the victim’s files, the ransomware collects and sends sensitive information such as Computer name, Username, Machine IP address, System UUID, and Discord tokens ... MITRE ATT&CK® Techniques ... T1082 ... System Information Discovery
The startencryption() function contains code to search files by enumerating the available directories in the C:\ drive. It looks for specific file extensions to encrypt and excludes a list of directories from the encryption process ... MITRE ATT&CK® Techniques ... T1083 ... File and Directory Discovery
It uses regex to find the Discord tokens in the local storage files and saves them in the list, then sends them to the Discord server along with other information using the below URL ... MITRE ATT&CK® Techniques ... Command and Control T1071 ... Application Layer Protocol
This ransomware uses the AES encryption algorithm to encrypt files ... After that, the malware starts the encryption process by enumerating the directories and encrypts the victim’s files using the AES-256-CTR algorithm, appending the extension as '.octo' ... Successful execution of Alice ransomware encrypts the victim’s files and appends the extension as '.alice' ... MITRE ATT&CK® Techniques ... T1486 ... Data Encrypted for Impact
16 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Windows .NET ransomware that encrypts files with AES, does not rename encrypted files, exfiltrates host details and Discord tokens, and displays a ransom note to obtain payment for decryption.
Analyzing the encryption method of emerging ransomware families ... Tags: AXLocker, Decryption, ransomware
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.